NSX Inventory and Infrastructure Sync Down in SSP 5.1.1 due to Stale Transport Nodes

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

In a Security Services Platform (SSP) 5.1.1 environment integrated with NSX 4.2.1, the following symptoms are observed:

• The SSP UI reports both Inventory Sync and Infrastructure Sync as DOWN.
• The SSP site fails to reach a READY state and remains stuck in onboarding.
• nsxapi.log shows the below error :
  
  A certificate batch replace operation cannot be started at this time because conflicting operations are running: TRANSPORT_NODE_ONBOARDING_IN_PROGRESS. Try again later. (Error code: 2190)
• SSP site-service logs show below:

ERROR    reconcileNappApplianceInfo    failed to validate and replace NSX certificate    {"request": {"name":"ccccccccccccccccccc","namespace":"nsxi-platform"}, "reconcileID": "00000000000000", "cert_id": "xxxxxxxxxxxxxxxxxxxxxxxxx", "error": "failed to replace certificate: failed to replace certificate: error while executing API call to https://nsx-ccccccccccccccccccccc/api/v1/trust-management/certificates/action/batch-replace: {\n  \"httpStatus\" : \"BAD_REQUEST\",\n  \"error_code\" : 2190,\n  \"module_name\" : \"internal-framework\",\n  \"error_message\" : \"A certificate batch replace operation cannot be started at this time because conflicting operations are running: TRANSPORT_NODE_ONBOARDING_IN_PROGRESS. Try again later.\"\n}"}

Environment

SSP Version: 5.1.1

Cause

The issue is caused by Standalone Transport Nodes (TNs) or TNs part of the cluster becoming stuck in an inconsistent lifecycle state, specifically UNINSTALL_FAILED with a HOST_DISCONNECTED status. This typically occurs due to an incomplete NSX removal or a loss of heartbeat between the manager and the host.

Because these nodes are in a transitional state, NSX incorrectly treats the onboarding process as still "in-progress." This locks the system and prevents the certificate replacement operations required for the SSP-NSX handshake.

Resolution

To resolve the sync failure, you must forcefully clear the stale Transport Node entries:

Identify Affected Hosts:

Log in to the NSX Manager UI.
Navigate to System → Fabric → Hosts → Standalone/ Clusters.
Identify any hosts listed with the status UNINSTALL_FAILED or HOST_DISCONNECTED under Hosts or Nodes.

Note: If any host Transport node part of cluster is stuck in similar state, remove from the cluster and proceed to next steps .

Force Remove NSX:

Select the affected host(s).
Click Delete NSX or Remove NSX.
When prompted, select the Force Remove option.

Verify Restoration:

Confirm the host is successfully removed from the NSX inventory.
The NSX Manager will now allow certificate replacement to proceed.
The SSP site-service will automatically retry the connection, and the site status should transition to READY. If the status does not update automatically, restart the site-service pod and wait 5 seconds for it to reach the READY state.